..I~O CfC\;'/OODQ ALGORITHM REGISTER ENTRY a) ISO Entry Name fi.so s.~o.I\A~dtCfq,~ 1"\->11-;'-.(~)} b) Name of Algorithm MULTI2 c) IntendedRange of Application 1. Confidentiality 2. HashFunction -as detailedin ISO 10118-2 3. Authentication -as detailedin ISO 9798 4. Data Integrity -as detailedin ISO 9797 d) CryptographicInterface Parameters 1. Input size 64 bits 2. Output size 64 bits 3. Key length: Data key 64 bits Systemkey 256 bits 4. Round number positive integer e) Test Data ROUND NUMBER 128 SYSTEMKEY all O's for 256 bits of systemkey DATA KEY (0123 4567 89AB CDEF) hex INPUT DATA (0000000000000001 )hex INTERMEDIARY (4th ROUND) (772F 558A F46A C13B )hex INTERMEDIARY (8th ROUND) (696E F331 5EDF OBFB )hex INTERMEDIARY (16h ROUND) (9E89 DA58 87CO 8518 )hex INTERMEDIARY (32th ROUND) (3F98 2A 1 F 459A 8023 )hex INTERMEDIARY (64th ROUND) (11 BD C4DO 9DF3 99A8 )hex OUTPUT DATA (128thROUND) (F894 4084 SEll CF89 )hex t) SponsoringAuthority Information-Technology Promotion Agency, Japan(IP A) Shuwashibakoen3-chome Bldg., 6F, 3-1-38 Shibakoen, Minato-kuffokyo 105, JAPAN Tel: +81-3-3437-2301 Fax: +81-3-3437-9421 RegistrationRequested by Hitachi, Ltd. SoftwareDevelopment Center Contactfor Information HisashiHashimoto SeniorEngineer Hitachi, Ltd. SoftwareDevelopment Center WorkstationNetwork SoftwareDepartment TYG 11thBldg. 16-1 3-chome,Nakamachi 1 ISO ,~,Ct /ooo,! ' Atsugi-shi243, JAPAN Tel: +81-462-25-9271 Fax: +81-462-25-9395 g) Date of submission Date of registration II+-No\le.",be..r ,qq Lt- h) Whether the Subject of a National Standard No. i) Patent -License Restriction Two patentsregistered: 1. United States Patent, No. 4,982,429 2. United States Patent, No. 5,103,479 One patent applied for: 3. Japan,No. 63-103919 For commercial use of MUL TI2, a license and fee is required. j) References See ISO 8372 or ISO/IEC 10116 for its information on modes of operation. k) Description of Algorithm MUL TI2 is a symmetric block cipher algorithm based on the permutation -substitution calculation like DES. Since MUL TI2 was published in 1989, the cryptographic strength of MUL TI2 has been tested through a number of cryptanalysis attacks. It is designed to realize a high performance on 32-bit computers. For example, MUL TI2 with the round number N=32 exhibits the memory -memory encryption speed of about 1 Mbps per 1 MIPS computing power. As the full specification of MUL TI2 is open, it can be used for software implementation of security mechanisms in open/multivendor networks. See Appendix for detail. 2 , .,. ISO~~'~/.OO' 1) Modes of operation Modes of operation as defined in ISO 8372 or ISO/IEC 10116 are applicable: 1. Electronic Codebook (ECB) Mode 2. Cipher Block Chaining (CBC) Mode 3. Cipher Feedback (CFB) Mode 4. Output Feedback (OFB) Mode m) Other infonnation In general, it is not possible to prove that an encryption algorithm and its environment are perfectly safe. However, a comparison of cryptographic strength between two encryption algorithms may help to obtain a safety measure. It is reported that MULTI2 with the round number less than thirty-two may be broken easier than DES. However, no method has been reported which can break MUL TI2 with the round number thirty-two or more. The cryptographic strength of MUL TI2 algorithm becomes higher as the round number N increases. On the other hand, the speed of MUL TI2 encryption is almost inversely proportional to the round number. The encryption speedof MUL TI2 with the round number thirty- two is about 1 Mbps per 1 MIPS computing power. In some cases, it is recommended that a trade-off between the speed and the safety margin be examined to detennine the round number of MUL TI2. 3 ..~"Ji ., I l~ol1q,':r {00°1 ; APPENDIX: DETAIL OF MUL TI2 ALGORITHM Basic functions (Involutions) Encryption process 32bits 32bits I ~ Key schedule Encryption ~ -r 1l'1 Data key (64 bits ) .4 bits) k1 (32bits) System N= 1 1l' 2 (256Key N= 2 bits) N= 3 N= 4 k2 (32bits) N= 5 N= 6 k3 1l'3 N= 7 (32bits) N= 8 . -# k4 Ciphertext (64 bits) (32bits) 1l'4 Symbols Ee : bit-wise exclusive OR, +: addition in modulus 2 32, -: subtraction in modulus 2 32 , Rots: s bits left circular rotation, V : bit-wise logical OR, N : round number II : concatination of data elements, T[left] : the string composed of the 32 leftmost bits of the block T T[right] : the string composed of the 32 rightmost bits of the block T 4 . .r I I$OGQ'1Ct/oooc, Definition of basic functions Encryption 1. 7r 1 Let Wk be the work key: Let T be the input to 7r 1. Then, the output of 7r1 is obtained: Wk=w1 II w2 II """ II w8 7r1 (T)= T [left] II (T [left] @ T [right] ) Let P be the plaintext. Let N=8m+ a (O~ a ~7) be the round number. 2. 7r 2 Then, the ciphertext C is obtained as follows: Let T be the input to 7r2. Let k1 be the key value. Then, the Let fWk be the function: intermediates x, y and z are calculated as: fWk=7r4ws " 7r3w6.w7 " 7r2wS" 7r 1" 7r4w4 "7r3w2.w3. 7r2w1 "7r 1 x= T [right] Let FWk be the function: y=x+k1 FWk=fWk"fWk" """ "fWk Z=Rot1(y)+y-1 where the calculation of fWk is repeated m times. The output of 7r 2 is obtained: If a =0, then 7r 2 k1 (T)=( T [left]@(Rot4(z)@z» II T [right] C=FWk(P) 3.7r3 Ifa=1,then Let T be the input to 7r3. Let k2 and k3 be the key values. Then, the C= 7r1 " FWk(P) intermediates x, y, z, a, band c are calculated as: If a =2, then x= T [left] C=7r 2w1 "7r 1'FWk(P) y=x+k2 If a =3, then z=Rot2(y)+y+ 1 C= 7r3 w2,w3 " 7r 2 w1 " 7r1 'FWk(P) a=Rot8(Z)@Z If a =4, then b=a+k3 C=7r4w4 "7r3w2,w3 "7r 2w1 '7r 1 "FWk(P) C=ROt1(b)-b If a =5, then The output of 7r 3 is obtained: C= 7r 1" 7r 4 w4 " 7r 3 w2,w3 " 7r 2 w1 " 7r1 "FWk(P) 7r 3 k2,k3(T)= T [left] II (TIright]@( ROt16(C)@(CVx» ) If a =6, then 4. 7r4 C=7r2wS'7r1"7r4w4'7r3w2,w3"7r2w1"7r1'FWk(P) Let T be the input to 7r4. Let k4 be the key value. Then, the If a =7, then intermediates x and yare calculated as: C= 7r 3 w6,w7" 7r2 wS" 7r1 " 7r 4 w4 " 7r 3 w2,w3 " 7r2 wI " 7r1 "FWk(P) x= T [right] Decryption y=X+k4 The inverse function of fWk is obtained as: The output of 7r 4 is obtained: fWk-1 = 7r1 " 7r 2 wI " 7r 3 w2,w3" 1l 4 w4 " 7r1 " 7r2 wS" 1l 3 w6,w7" 7r4 we 7r4 k4 (T)=( T [Ieft]@ ( Rot2(y)+y+ 1) ) II T [right] Then, the inverse function of FWk is obtained as: Key schedule Fwk-1 =fWk-1 "fWk-1 , """ "fW<.-1 Let Dk be the data key. where the calculation of fWk -1 is repeated m times. Let Sk be the system key: Then, the plaintext P is obtained as follows: Sk=s111 s2 II """ II s8 If a =0, then where s1, s2, """, s8 are 32-bit data blocks. P=FWk-1 (C) The work key Wk is obtained: If a =1, then a1=7r251 "7r1(Dk) P=FWk-1"7r1(C) w1=a1[left] If a =2, then a2= 7r 3 52,53(a1) P=FWk-1 "7r 1" 7r2wl (C) w2=a2 [right] If a =3, then a3= 7r 4 54 (a2) P=FWk-1 "7r 1 " 7r 2 wI " 7r3 w2,w3(C) w3=a3 [left] If a =4, then. a4=7r1 (a3) P=FWk-1" 7r1' 7r2wl" 7r3w2,w3" 7r4w4(C) w4=a4 [right] If a =5, then a5=7r 25S (a4) P=FWk-1.7rI"7r2wl"7r3w2.W3"7r4W4"7r1(C) w5=a5 [left] If a =6, then a6=7r356,57(a5) P=FWk-1"7r1"7r2wl"7r3w2,W3"7r4w4"7rI"7r2wS(C) w6=a6 [right] If a =7, then a7=7r45s(a6) P=FWk-1"7rI'7r2wl'7r3w2,W3"7r4w4"7r1'7r2wS'7r3w6,W7(C) w7=a7 [left] a8= 7r 1 (a7) w8=a8 [right] Wk=w1 II w2 II """ II w8 5 ---~'-, , " 11",..;.""",..0 I II.